Endpoint Protection Manager is failing to create forward merge delta files for antivirus definitions

book

Article ID: 162281

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection Manager (SEPM) is failing to create forward merge delta files for antivirus definitions

 

Error messages and other symptoms

  • "Merge failed, ZERO BYTE DAX file" errors in SEPM ContentMergeTask logs
     
  • SymDelta folders are accumulating in SEPM's service temp folder (location may vary).
    Example temp folder contents:
     Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp
    ...
    08/14/2015  11:03 AM    <DIR>          SymDelta_1092
    08/13/2015  01:42 PM    <DIR>          SymDelta_2968
    08/13/2015  01:31 PM    <DIR>          SymDelta_3144
    08/13/2015  06:19 PM    <DIR>          SymDelta_3764
    08/16/2015  11:59 AM    <DIR>          SymDelta_6368
    08/17/2015  01:32 AM    <DIR>          SymDelta_6576
    08/13/2015  06:58 AM    <DIR>          SymDelta_6684
    08/17/2015  06:19 AM    <DIR>          SymDelta_8820
    08/15/2015  12:32 PM    <DIR>          SymDelta_9808
    08/12/2015  11:01 PM    <DIR>          SymDelta_9992
    ...
     Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SymDelta_1092
    08/14/2015  11:03 AM    <DIR>          .
    08/14/2015  11:03 AM    <DIR>          ..
    08/14/2015  11:04 AM    <DIR>          xdelta150804016_To_150813035.dax.tmp
    08/14/2015  11:03 AM    <DIR>          xdelta150804016_To_150813035.dax_MERGE_.tmp
                   0 File(s)              0 bytes
     Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SymDelta_1092\xdelta150804016_To_150813035.dax.tmp
    08/14/2015  11:04 AM    <DIR>          .
    08/14/2015  11:04 AM    <DIR>          ..
    08/14/2015  11:03 AM                34 CATALOG.DAT.DIFF
    08/14/2015  11:04 AM             1,446 cur.scr
    08/14/2015  11:03 AM            20,792 ESRDEF.BIN.DIFF
    08/14/2015  11:03 AM         6,216,022 HF.DAT.DIFF
    08/14/2015  11:03 AM         2,149,802 HP.DAT.DIFF
    08/14/2015  11:03 AM         6,700,170 TCDEFS.DAT.DIFF
    08/14/2015  11:03 AM            24,929 TCSCAN7.DAT.DIFF
    08/14/2015  11:03 AM               424 TCSCAN8.DAT.DIFF
    08/14/2015  11:03 AM           113,086 TCSCAN9.DAT.DIFF
    08/14/2015  11:03 AM                42 TINF.DAT.DIFF
    08/14/2015  11:03 AM                37 TINFL.DAT.DIFF
    08/14/2015  11:03 AM                72 TSCAN1.DAT.DIFF
    08/14/2015  11:03 AM             1,110 V.GRD.DIFF
    08/14/2015  11:03 AM               322 V.SIG.DIFF
    08/14/2015  11:03 AM               322 V1.SIG.DIFF
    08/14/2015  11:03 AM             9,331 VIRSCAN1.DAT.DIFF
    08/14/2015  11:03 AM                85 VIRSCAN2.DAT.DIFF
    08/14/2015  11:03 AM               106 VIRSCAN3.DAT.DIFF
    08/14/2015  11:03 AM                57 VIRSCAN4.DAT.DIFF
    08/14/2015  11:03 AM            96,905 VIRSCAN5.DAT.DIFF
    08/14/2015  11:03 AM            36,181 VIRSCAN6.DAT.DIFF
    08/14/2015  11:04 AM         2,344,246 VIRSCAN7.DAT.DIFF
    08/14/2015  11:04 AM               562 VIRSCAN8.DAT.DIFF
                  23 File(s)     17,716,083 bytes
    
    
    

Cause

This problem may occur when SEPM is installed on 32-bit machines and the forward delta generation is merging a group of smaller files whose accumulated size is greater than about 100MB. NOTE that the ZERO BYTE DAX error and temp folder accumulation may be a result of other issues; please consult Symantec Technical Support to confirm root cause.

Resolution

A workaround is to limit the delta size to something under 100MB for 32-bit operating systems:

  1. Stop SEPM services
  2. Add following line to %SEPM_HOME%\tomcat\etc\conf.properties:
    scm.content.delta.merge.invoke.size.limit.x86=83886080
  3. Restart SEPM services.

Symantec is aware of this issue and is working on a fix to the product so that the workaround will be unnecessary. This article will be updated as new information becomes available.